Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:39
Static task
static1
Behavioral task
behavioral1
Sample
688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe
-
Size
291KB
-
MD5
688e14c833fbf6c95e9650360d02dd0c
-
SHA1
44df08300d83f1d8b8d718b8f7a784ff7e9c70a0
-
SHA256
894b1035b22d5321155f5ee74f590eabb7c52aa554bcadeb0b4c28be93ee9747
-
SHA512
6149170aea4880962d5f28f35a0cd6758ee29326b04ebe73323dbe0850623cbbece20f706d95119add021caf34a642f34a52695fcfe8bf5f20eab11b904a3e37
-
SSDEEP
6144:wZUyi7Uh0WQaaAJ0UU4BVSEqkm+mYcy9BhcjhLh1sz3s2m:wip7UhEaJJ0UGENJmVyPhqJnMs3
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\IDSCPRODUCT = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe\"" 688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exedescription pid process target process PID 2784 wrote to memory of 3068 2784 688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe 688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe PID 2784 wrote to memory of 3068 2784 688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe 688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe PID 2784 wrote to memory of 3068 2784 688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe 688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\688e14c833fbf6c95e9650360d02dd0c_JaffaCakes118.exe" 3 true2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2784-0-0x000007FEF4FCE000-0x000007FEF4FCF000-memory.dmpFilesize
4KB
-
memory/2784-1-0x0000000000360000-0x000000000036C000-memory.dmpFilesize
48KB
-
memory/2784-2-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmpFilesize
9.6MB
-
memory/2784-3-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmpFilesize
9.6MB
-
memory/2784-5-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmpFilesize
9.6MB
-
memory/3068-6-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmpFilesize
9.6MB
-
memory/3068-7-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmpFilesize
9.6MB
-
memory/3068-4-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmpFilesize
9.6MB
-
memory/3068-8-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmpFilesize
9.6MB